InfoSecBulletin Cybersecurity for mankind
Bangladesh’s military and defense system is actively under targeted attack linked to DoNot Team, or APT-C-35, as stated in a cybersecurity advisory from BGD e-GOV CIRT. This attack aims at Bangladesh military and defense staff using fake documents that look like real info about a high-ranking officer in the Bangladesh Air Force.
The attack starts with a malicious RTF file that looks like a .doc file. Instead of having the main virus inside, the document gets a harmful Microsoft Word template from the attacker’s server. The attack uses victim filtering and geofencing, which means harmful content is sent only to the intended targets, while safe content may be shown to researchers or other systems not being targeted.
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
The campaign uses a DLL implant that can stay active, gather information about infected systems, talk to command-and-control servers over HTTPS, encrypt data, and download more modules depending on the victim’s profile.
How the Attack Works
The first bait is called “Biography Air Vice Marshal Sitwat Nayeem.doc.” It looks like real biographical information about a high-ranking officer in the Bangladesh Air Force. The use of military details specific to Bangladesh shows that they are choosing their targets carefully instead of just sending out a lot of phishing emails.
When open the weaponized document, it tries to get a template from the outside. The advisory points out a hidden remote template URL linked to the campaign.
The campaign’s setup makes it harder to detect by sorting victims. Researchers saw that some requests got a safe Word template, while the targets got the harmful VBA-enabled one. The sorting uses factors like source IP, location, request details, and how Microsoft Word behaves.
Advanced Malware Techniques
Once the malicious template is sent, VBA code runs on its own and picks the right shellcode for 32-bit or 64-bit Microsoft Office systems. The malware misuses Windows APIs and runs shellcode in the Office process using callbacks.
The shellcode is very hidden. Researchers saw a decoding process that uses bitwise NOT and XOR operations. API functions are found in real-time using PEB traversal and ROR7-based API hashing. These methods lower the readable information for standard static analysis.
The malware has features to avoid detection and analysis. It looks at function codes for signs of hooks or debugging and tries to change how it runs if it finds anything unusual.
Multi-Stage Payload Delivery
The campaign uses multiple file extensions to disguise malicious payloads, including .ico, .mp3 and .doc. One stage is delivered as an apparent icon file, while another .mp3 path delivers the next malicious payload and the .doc path is associated with decoy content.
The last part mentioned in the warning is a DLL implant that helps with staying on the system, gathering information, secure communication, registering victims, getting specific files, and removing traces. The DLL runs using rundll32.exe.
Persistence and Victim Profiling
The malware keeps running by using a Windows Scheduled Task that looks like real Microsoft OneDrive data collection. The task has a OneDrive-like name and starts the harmful DLL from a temporary folder using rundll32.exe.
After infection, the implant collects information including:
CPU information
Operating-system version
Username
Computer/hostname
Hardware identifier
Installed software
The gathered information is coded with AES-CBC and then changed to Base64 before it is sent to the control center. This method helps attackers figure out how important and what type of the compromised systems are before they use more tools.
Command-and-Control Infrastructure
The Stage-4 implant talks to its users using HTTPS on TCP port 443. The advisory says that reggyupdated[.]info is the known C2 server and explains a two-step process that includes victim sign-up and then getting the payload based on conditions.
Researchers found a live follow-on module called ejtest.dll. This showed that the system was working and could send more malware during the investigation. The module talked to exessupdate[.]info and had similar encrypted HTTPS and delivery features.
Why Bangladesh Is a Specific Target
The campaign is troubling due to its social-engineering tactics designed for Bangladesh’s military context, with a biography-themed lure indicating prior reconnaissance of the target community.
Potentially exposed organizations include:
Bangladesh Armed Forces
Ministry of Defence and related organizations
Defence contractors and suppliers
Diplomatic missions
Strategic government organizations
Military research and educational institutions
Personnel communicating with defence establishments
Organizations maintaining trusted relationships with defence networks
A successful attack could give hackers access to information about military staff, internal papers, how the organization is set up, software that is used, and communication about operations.
Indicators of Compromise
The advisory lists some file and host indicators, like hashes related to the biography lure, Stage-4 agent, ejtest.dll, and a shellcode sample disguised as an ICO. It also points out odd files, folders, scheduled tasks, and C2 parameters like mopd= and malp=.
Security teams should particularly investigate:
%TEMP%\BinSat\
dn110mploc.dll
a4Strau
OneDrive-themed scheduled tasks
rundll32.exe loading DLLs from temporary directories
Unexpected Office-to-Internet connections
HTTPS POST requests containing mopd= or malp=
BGD e-GOV CIRT advises to quickly block confirmed domains, IP addresses, and file hashes on firewalls, DNS, proxies, secure email gateways, EDR/XDR, and SIEM platforms. Groups should look through past data, not just current connections.
Security teams should:
Hunt for the biography-themed RTF and related spear-phishing attachments.
Restrict external remote-template retrieval from Microsoft Office where operationally possible.
Disable or tightly control macros originating from Internet-sourced documents.
Investigate unexplained Internet connections originating from Microsoft Office.
Hunt for rundll32.exe executing DLLs from temporary or user-writable directories.
Investigate suspicious OneDrive-themed scheduled tasks.
Monitor for mopd= and malp= network activity.
Treat communication with confirmed campaign infrastructure as a potential compromise.
Isolate suspected systems and conduct forensic investigation.
Reset credentials used on confirmed compromised endpoints and investigate possible credential exposure.
Incident Response
If a sign or related action is found, organizations should quickly separate the affected device and keep important evidence if they can. Investigators need to gather memory images, suspicious RTF/DOC files, Office process data, scheduled task settings, temporary files, DNS and firewall/proxy logs, EDR process trees, email headers, browser/network data, and Windows Event Logs.
The signs of Stage-4 persistence or C2 communication mean the attack has gone past just sending documents. If there is proof of further actions, the investigation needs to look beyond the first computer because we may not know everything about what each delivered part can do.
